Radiant Logic Glossary

Active Directory (AD) is a proprietary directory service from Microsoft. The Active Directory directory service stores and manages information about users, network resources, and application-specific data.

AI-driven Identity and Access Management (IAM) refers to the utilization of Artificial Intelligence (AI) in managing user identities and controlling access privileges to critical resources within a company. It fills the need for cybersecurity solutions that monitor permissions and ensure the safety of sensitive information.

AI-driven IGA uses artificial intelligence to oversee, evaluate, and govern identities and their access within an organization. Integrating AI into the IGA process helps companies leverage advanced analytics and machine learning capabilities to streamline identity management.

An application program interface (API) is code that allows two software applications to communicate. It defines the correct and most efficient way for developers to request services from an external application and expose data within different contexts.

Attestation or access certification is the process of an object or resource owner “asserting” that a given account should still exist, is still active and being used, and that the access levels are correct. Many legal and regulatory compliance guidelines enforce attestation, and it is also good practice for organizational identity management.

Attribute Based Access Control (ABAC) is the best practice for securing access to an enterprise’s most important, valuable and regulated digital assets and resources. With ABAC, enterprises can enable any number of data sharing scenarios, either within or between organizations, that comply with business, security and regulatory constraints.

Authentication is the broad category for a digital process that determines who you are, and makes you prove that you are that person by verifying your credentials against your account information.

Authorization determines what you’re allowed to see and do within an application. There are basically two main methods for enforcing authorization: checking group membership or checking the value of specific user attributes.

CCPA is a state data privacy law patterned after the EU GDPR. It protects the privacy rights of California residents and gives California consumers more control over the collection and use of their personal information.

Claims, also called assertions, are a statement made by an entity about itself, such as a name, key, group, or privilege. Typically included in security tokens and used as part of an authorization workflow.

Cloud Infrastructure Entitlement Management (CIEM) is a technology solution that helps organizations manage data governance and user entitlements across their cloud environments.

The ability to swap out architectural components in an enterprise architecture. A composable architecture creates flexibility and allows for a best-of-breed infrastructure.

Context describes: how does this person relate to other people, objects, or services within the enterprise ecosystem? Contextual insight into relationships across systems enables the organization to strengthen security and better serve its consumers.

Correlation, for a complex identity system containing multiple same-users, is an important function for establishing unified identity. This process disambiguates the digital identity of each user, and can be based on cascading rules where required to establish a common identifier across heterogeneous systems.

CIAM is a system or set of capabilities for managing and using the digital identity of end-users, customers, and anyone external to the organization. It ensures consumers can access appropriate digital assets, applications, and services, and manages their identity data within the organization’s systems.

Cybersecurity Mesh is the emerging best practice architecture for enabling different security services to interoperate and form a cutting-edge secure environment. Based on easy integration between services as an enabler for enhanced security, Cybersecurity Mesh Architecture (CSMA) aims to simplify and future-proof the infrastructure.

A data-centric security model focuses on the reliability of underlying data itself, instead of centering the security of networks, servers, or applications.

Digital transformation is the incorporation of technologies into an enterprise’s process, strategies, and products. These initiatives are typically done to better engage and serve their workforce and customers while improving the ability to compete in the marketplace.

Entitlements, also known as authorizations, privileges, or permissions, are IT access policies used to manage access to data, devices, services, and applications. They define what a given identity (such as a user, role, or group) is authorized to access and do. Entitlements systems can help automate workflows, access assignments, reviews, and expirations as part of an identity management system.

Federated access is a framework of trust between connected systems that authenticates users more efficiently and securely than if users had to log in to each system individually.

Federated Identity represents an approach to managing the distributed identity infrastructure in a logical way. Rather than over-centralizing, federated identity allows local authoritative systems to maintain identity in their own way, while using virtualization to build a logical, central access point to unified data from across the organization.

An advanced approach to authorizing user access to resources, Fine Grained Authorization describes a mechanism for determining and enforcing authorization in a granular way. It allows policy creators to implement access rules and policies based on multiple factors and conditions.

The GDPR is a European Union (EU) law designed to ensure personal data is protected, and to give EU citizens more control over their data. It applies to any company that does business with EU citizens, regardless of where the company is located.

Generative AI’s integration into IAM helps to counteract threats and security weaknesses by analyzing user behavior and detecting anomalies. Its potential extends to monitoring access policies and identifying possible internal threats and enabling organizations to take preemptive action against such risks.

The Global Profile is the complete set of information– identifiers, attributes, group memberships, and so on– about each user in the system. The Global Profile maintains links back to the local sources of all of a user’s local profiles/accounts.

IAM Copilot, powered by GenAI technology, is a category of tool that streamlines complex identity and access management tasks through natural language interactions, enhancing user experience in IAM operations.

IAM is an information technology (IT) framework combining powerful policies, processes, and technologies that enable the management and oversight of digital identities to ensure that the right people and roles can access the tools and data they need to do their job.

An Identity Data Fabric unifies distributed identity data from all sources within an organization in order to turn identity data into a flexible, reusable, and scalable resource. Using virtualization and synchronization capabilities, it first connects all sources of identity—from both on prem and cloud sources. The fabric then creates complete attribute-rich global profiles for all users that is consumable in whatever protocol is required by the application.

An identity data lake is a repository that stores, manages and secures vast amounts of raw identity-related data. It differs from traditional data lakes by focusing exclusively on identity information, such as user attributes, access logs, authentication details, and authorization policies.

Identity data quality encompasses the accuracy, completeness, consistency, validity, uniqueness, and integrity of the data associated with an individual’s identity, empowering organizations to make well-informed decisions rooted in dependable information.

The Identity Fabric is a distributed identity framework for supporting and enabling IAM. The Identity Fabric approach relies on integration between IAM tools to enable any users, devices, and service IAM scenarios across the identity landscape.

Identity Governance and Administration (IGA) is an Identity Access and Management (IAM) discipline that enables the governing and administration of digital identities by automating the creation, certification, and management of user accounts, roles, and access rights.

What is an identity graph? A knowledge graph, but make it identity. Just as a knowledge graph is a key element for an identity fabric, the concept of identity graph is the same for an identity data fabric. An identity graph represents entities and their relationships to each other, across all of an organization’s objects, […]

An identity hygiene strategy encompasses the maintenance of infrastructure, application, database and directory data to help implement effective identity and access management (IAM) programs that mitigate risk, ensure authorized access and prevent data breaches based on identity data integrity.

Identity lifecycle management is the process of managing user identities and their related access privileges to the network, applications, systems, and data. It spans the entire span of a user’s need to access these systems and resources from onboarding to deprovisioning or removal. It is done through a combination of technologies and business processes.

Half of the M in IAM–Identity Management encompasses a set of functionalities from identity lifecycle management, provisioning, role management, to design and implementation of workflows, for the purpose of providing a central service for managing identity creation and management– and ultimately securing access to resources.

An identity provider (IdP) is a service that manages and verifies user identity. It’s used by other applications, systems, and other digital services as part of an identity authentication workflow, such as single sign-on (SSO) providers.

Identity Security Posture Management (ISPM) involves continuously monitoring and assessing an organization’s identity infrastructure to ensure that access rights and permissions are effectively managed and aligned with their security policies.

Identity sprawl is the rapid growth of enterprise identity silos, and the explosion of user information, attributes, and credentials that goes along with it. This can result in multiple accounts for each user, and a limited, fragmented understanding of the organization’s identity assets.

Identity Synchronization is the process of bi-directionally synchronizing objects distributed across disparate data sources (directories, databases or applications): a change in an object in one source, at the attribute level, or for the whole object can be reflected into many other connected objects.

Identity Unification is a process that takes identity data from all sources and protocols, creating a unique reference list and rich global profile of all users which is securely consumable by anything, anywhere, anytime.

What is an Identity Warehouse?  An Identity Warehouse is a component of the IAM architecture meant to be a comprehensive, always-available, always-up-to-date authoritative “source of truth” of all identity data in the enterprise. The Identity Warehouse must be more than a static source of entitlements; it needs to be real-time-accessible for making split-second access decisions; […]

ICAM refers to the programs, processes, technologies, and people used to create trusted digital identity representations of people and non-person entities (NPEs) present on a network.

The Internet of Things (IoT) is the name for an aggregate collection of network-enabled devices that contain embedded technology but aren’t traditional computers or servers. These devices communicate with other devices and networks to exchange data, send data one way for analysis, or control and monitor physical sensors and actuators.

Joins are used as a way to extend a primary set of entries with attributes from other objects. In general, joins are a way to provide additional context at the level of an entry.

Least privilege is an IAM concept used to ensure that users, programs, processes, and systems have the bare minimum level of access or permission they need to perform their role or function.

LDAP is an industry-standard, open protocol used to access and manage directory information services. It enables the sharing of information about users, systems, networks, services, and applications.

What is a Master User Record? The Master User Record or “MUR” contains all the entitlements an entity has been granted, providing a unique representation of that single user’s accounts, personas, attributes, and credentials within an organization. What is the purpose of a Master User Record? By consolidating a comprehensive set of each user’s job […]

Model-driven virtualization is the essential tool for externalizing and projecting identities into a logical identity layer, while leaving underlying sources untouched. A unified view of the data from across sources in one global model enables organizations to understand different user contexts and quickly transform to meet changing requirements.

MFA is an identity authentication method requiring users or entities to provide 2+ verification factors to access a resource. Each additional factor is intended to increase the assurance that the user requesting access or communicating with the receiving system is who or what they say they are.

OAuth (Open Authorization) is an authorization framework for providing a user with secure access to applications without giving the application a password.

A one-time password (OTP) is a password that authenticates a user for a single login session or network transaction. It’s typically generated by the system being accessed and is generally more secure than a static password as it does not need to be remembered beyond the session.

OpenID Connect (OIDC) is an authentication protocol that allows users to use an OpenID account with a third-party provider service, which is then used for authentication.

Personally-Identifying Information (PII) is any information that can identify an individual when used alone or with other relevant data.

Privileged Access is the process of assigning higher access levels to particular systems, data, or resources. It’s a way to secure sensitive data at a more granular level to ensure optimized usage across enterprises.

PAM is a combination of processes and technology used to secure, control, and monitor access to critical information, resources, and systems. It generally refers to the assignment of permission access levels to user accounts based on a predetermined set of guidelines or rules.

Privileged Accounts typically refer to a type of account with the highest level of access to systems, applications, data, and resources. They can be human- or systems- based.

A Relying Party (RP) refers to a partner in a federation that consumes security tokens for providing access to applications.

REpresentational State Transfer (REST) is an architectural style for development that emphasizes a uniform interface between components. It is designed to optimize data transfer at scale across the Internet through a series of guiding principles and constraints.

A Secure Token Service (STS) is a component that issues, validates, renews, and cancels security tokens for trusted systems, users, and resources requesting access within a federation.

Security Assertion Markup Language (SAML) allows users to access multiple web applications after entering a single set of login credentials.

Within the context of IAM, security tokens are part of an IT method for granting access to users across domains. Trusted sources assign the tokens to trusted entities to allow them access to protected networks, systems, data, and applications.

Single Sign-On offers a trusted authentication method that allows users to log in once to access multiple well-vetted systems and services—all without having to re-enter authentication factors such as their username and password.

What is Technical Debt? Technical debt refers to ineffective and/or redundant technology systems that incur costs without equal returns or benefit to their organization, and which in fact hampers IT agility and slows business progress. Examples include legacy LDAP directories, custom applications, non-standards-supporting solutions, and immature security software. Technical debt is often difficult to evolve […]

Union is the ability to create a global list where each user is represented once and only once, even if they have multiple accounts spread across the identity infrastructure of an enterprise organization.

Provisioning, also called user provisioning or account provisioning, involves the creating, modifying, disabling, and deleting of user accounts and their profiles across an organization’s infrastructure.

A Virtual Directory (VD) or a Virtual Directory Server (VDS) is an architectural component that delivers a single access point to identity for consuming applications for the purpose primarily of access. It is a software layer that consolidates disparate sources of identity into a central virtual namespace acting as an enterprise directory.

Zero Trust Architecture is a security model and strategy that assumes there are threats within and outside of the network at all times. It enforces principles of least privilege to minimize risk, while determining access for users to resources via policies that are executed based on data coming from multiple sources.